Where is “that” anti-debug?
Introduction Of AntiDebugSeeker
Takahiro Takeda© 2024 LAC Co., Ltd.

Profile
Takahiro Takeda
Malware Analysis Team
Cyber Emergency CenterLAC

2016: Analysis work as a Security Analyst at JSOC.
2017: Analyzing malware and logs, as well as investigating smishing, at the Japan Cyber Crime Control
Center (JC3).
2019: Responsible for malware analysis related to incidents at the Cyber Emergency Center.
Speaker Experience:
2020: PACSEC.
2020: AVAR (Association of Anti-Virus Asia Researchers).
2021: HITCON.

Agenda© 2024 LAC Co., Ltd.

1.

Introduction of the AntiDebugSeeker

2.

Demonstration: Using IDA

3.

Future Work

3

Introduction of the AntiDebugSeeker© 2024 LAC Co., Ltd.

4

What is AntiDebugSeeker
This is a program for automatically identify and extract potential antidebugging techniques used by malware and displaying them in IDA.

The main functionalities of this plugin are as follows:
1.Extraction of APIs that are potentially being used for anti-debugging bythe malware.
2.In addition to APIs, extraction of anti-debugging techniques based onkey phrases that serve as triggers, as some anti-debugging methods
cannot be comprehensively identified by API calls alone.
For packed samples, running this plugin after unpacking and fixing the Import Address
Table is more effective.
© 2024 LAC Co., Ltd.

5

About anti_debug.config
The anti_debug.config file contains rules for detecting anti-debugging
features. It is divided into two sections: Anti_Debug_API and
Anti_Debug_Technique.
Anti_Debug_API

Anti_Debug_Technique© 2024 LAC Co., Ltd.

6

About Anti_Debug_API in anti_debug.config
In the Anti_Debug_API section, you can freely create categories and add
any number of APIs you want to detect. (exact match)###Anti_Debug_API###[Category Name_1]
API1
API2
API3
[Category Name_2]
API1
API2
API3

© 2024 LAC Co., Ltd.

7

About Anti_Debug_Technique in anti_debug.config
In this section, you can set up to three keywords (partial match) under a single rule name.
###Anti_Debug_Technique###
Default_search_range=80[Rule1]
ABC
EFG

HIJ

80bytes
80bytes

The basic flow of the search is as follows:First, the search begins with the first keyword. If it is found, the second keyword is thensearched for within a specified number of bytes (default is 80 bytes). This same process isapplied when searching for the third keyword.
Search Target:
Disassembly (Opcode, Operand)
Comments
API based on Import Table© 2024 LAC Co., Ltd.

8

About Anti_Debug_Technique in anti_debug.config
If you want to set a custom search range instead of using the default value,
you can specify 'search_range=value' at the end of the keyword you've set.
This allows you to change the search range for each rule you've configured.
###Anti_Debug_Technique###default_search_range=80[Rule1]ABC
EFG
HIJ
search_range=50[Rule2]KLM
NOP
search_range=200© 2024 LAC Co., Ltd.

9

anti_debug.config Editing Feature
Functionality for checking and editing the contents of anti_debug.config.
Ctrl + Shift + E (File Editing Feature)
After making changes,
click the 'Save' button to save the modifications.

© 2024 LAC Co., Ltd.

10

Support Functions
After running the plugin, detected APIs and keywords are highlighted in different colors.
Detection Category

Color

Anti_Debug_API

Green

Anti_Debug_Technique

OrangeAdditionally, if an API specified in Anti_Debug_API is detected, the category name is added as a comment. Likewise,
if a rule name is detected in Anti_Debug_Technique, a description of that rule is added as a comment to the firstdetected keyword.

© 2024 LAC Co., Ltd.

11

List of detectable anti-debugging techniques (ver1.0)
The following Anti Debug Techniques can be detected using AntiDebugSeeker.
HeapTailMarker
KernelDebuggerMarker
DbgBreakPoint_RET
DbgUiRemoteBreakin_Debugger_Terminate
PMCCheck_RDPMC
TimingCheck_RDTSC
SkipPrefixes_INT1
INT2D_interrupt_check
INT3_interrupt_check
EXCEPTION_BREAKPOINT
ICE_interrupt_check
DBG_PRINTEXCEPTION_C
TrapFlag_SingleStepException
BeingDebugged_check
NtGlobalFlag_check
NtGlobalFlag_check_2
HeapFlags
HeapForceFlags
Combination_of_HEAP_Flags
Combination_of_HEAP_Flags_2

ReadHeapFlags
ReadHeapFlags_2
DebugPrivileges_Check
Opened_Exclusively_Check
EXCEPTION_INVALID_HANDLE_1
EXCEPTION_INVALID_HANDLE_2
Memory_EXECUTE_READWRITE_1
Memory_EXECUTE_READWRITE_2
Memory_Region_Tracking
Check_BreakPoint_Memory_1
Check_BreakPoint_Memory_2
Software_Breakpoints_Check
Hardware_Breakpoints_Check
Enumerate_Running_Processes
ThreadHideFromDebugger
NtQueryInformationProcess_PDPort
NtQueryInformationProcess_PDFlags
NtQueryInformationProcess_PDObjectHandle
NtQuerySystemInformation_KD_Check © 2024 LAC Co., Ltd.
12

Updated functions© 2024 LAC Co., Ltd.

© 2024 LAC Co., Ltd.

13

Updated Feature: Detected Function List
Detected Function List

After launching the plugin with Ctrl+Shift+D, in addition to theAnti Debug Detection Results, we have added a feature to display theDetected Function List.

By adding this feature,
With the Anti Debug Detection Results, it becomes easier to grasp boththe detection outcomes and the overall flow of the code, while theDetected Function List allows for a more manageable debugging process
by providing information organized by each function. This enables
malware analysis from two distinct perspectives.

Updated Feature: Detected Function List – Basic Functions

You can search for results.

Mouse over to see rule explanations.

Double-click to jump
to a section.

Updated Feature: Detected Function List – Recursive Checking

Help Information：
Double Clicking on a function name starting with 'sub' allowsyou to recursively check that function.
Double-clicking on a function name enables you to trace where thatfunction is being called from recursively.
Functions displayed in gray have been detected inthe Detected Function List.
'depth: [number]' indicates the depth from theOriginal Entry Point (OEP).
Double-click to jump to the location where the function is beingcalled.

Mouse over to see the function's detection results from the
Detected Function List.

Demo : AntiDebugSeeker© 2024 LAC Co., Ltd.

17DEMO⚫ Malware : Ursnif MD5 : 4da11c829f8fea1b690f317837af8387 (Packed)

 MD5 : 952d604345e051fce76729ccb63bde82 (Unpacked)© 2024 LAC Co., Ltd.

18

© 2023 LAC Co., Ltd.

19

© 2023 LAC Co., Ltd.

20

© 2023 LAC Co., Ltd.

21

Future Work

Plugin being developed for
Ghidra version© 2024 LAC Co., Ltd.

22

Ghidra Script

It identifies based on the API
rules set in the anti_debug.config.

© 2024 LAC Co., Ltd.

23

Updated Version 1.1 Released
https://github.com/LAC-Japan/IDA_Plugin_AntiDebugSeeker© 2024 LAC Co., Ltd.

© 2024 LAC Co., Ltd.